CVE-2026-97533

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF

A previous commit protected against races between ptdump and CPA collapse,

however one still exists between attribute changes and collapse as reported

by Denis V. Lunev (linked).

When an attribute change arises, a lockless page table walker obtains a PTE

entry, which is later written to via set_pte_atomic():

...

-> change_page_attr_set_clr()

-> __change_page_attr_set_clr()

-> __change_page_attr()

-> _lookup_address_cpa()

-> lookup_address_in_pgd_attr()

-> [ lockless page table walker ]

-> set_pte_atomic()

There is nothing preventing a concurrent CPA collapse which can free the

PTE that was retrieved here, resulting in a use-after-free.

With the mmap write lock taken on init_mm over CPA collapse, resolve this

race by acquiring an mmap read lock on init_mm over

__change_page_attr_set_clr().

This locks across the whole operation ov

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References